Using Secrets as environment variables in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define an environment variable from a secret in a Pod spec.

Kubernetes

env:
  - name: PASSWORD
    valueFrom:
      secretKeyRef:
        name: mysecret
        key: [1]

Drag options to blanks, or click blank then click option'

Apassword

Btoken

Cusername

Dconfig

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong key name that does not exist in the secret.

Confusing the secret name with the key name.

The key field specifies which key from the secret to use as the environment variable value. Here, password is the correct key.

2fill in blank

medium

Complete the code to mount a secret as an environment variable in a container spec.

Kubernetes

containers:
- name: app
  image: myapp:latest
  env:
  - name: API_KEY
    valueFrom:
      secretKeyRef:
        name: [1]
        key: api_key

Drag options to blanks, or click blank then click option'

Amysecret

Bappsecret

Cconfigmap

Ddefaultsecret

Attempts:

3 left

💡 Hint

Common Mistakes

Using a ConfigMap name instead of a Secret name.

Using a secret name that does not exist in the cluster.

The name field under secretKeyRef must match the secret resource name. Here, mysecret is the correct secret name.

3fill in blank

hard

Fix the error in the environment variable definition from a secret.

Kubernetes

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: dbsecret
        key: [1]

Drag options to blanks, or click blank then click option'

Adb_password

Bdbpassword

Cpassword

Ddbpass

Attempts:

3 left

💡 Hint

Common Mistakes

Using a key name that does not match the secret's data keys.

Assuming the key name is the same as the environment variable name.

The key password is the standard key used in the secret for the database password. Other keys may cause the environment variable to be empty.

4fill in blank

hard

Fill both blanks to correctly define environment variables from two different secrets.

Kubernetes

env:
  - name: USERNAME
    valueFrom:
      secretKeyRef:
        name: [1]
        key: username
  - name: TOKEN
    valueFrom:
      secretKeyRef:
        name: [2]
        key: token

Drag options to blanks, or click blank then click option'

Ausersecret

Btokensecret

Cmysecret

Ddefaultsecret

Attempts:

3 left

💡 Hint

Common Mistakes

Using the same secret name for both environment variables.

Mixing up secret names and keys.

The first secret name is usersecret for the username, and the second is tokensecret for the token.

5fill in blank

hard

Fill all three blanks to create environment variables from a secret with keys 'username', 'password', and 'token'.

Kubernetes

env:
  - name: USER
    valueFrom:
      secretKeyRef:
        name: [1]
        key: [2]
  - name: PASS
    valueFrom:
      secretKeyRef:
        name: [1]
        key: password
  - name: TOKEN
    valueFrom:
      secretKeyRef:
        name: [1]
        key: token

Drag options to blanks, or click blank then click option'

Aappsecret

Busername

Cmysecret

Dusersecret

Attempts:

3 left

💡 Hint

Common Mistakes

Using different secret names for each environment variable.

Confusing the key names with environment variable names.

The secret name is mysecret. The key for the USER environment variable is username. The other keys are password and token.

Practice

1. What is the main purpose of using Kubernetes Secrets as environment variables in a Pod?

easy

A. To keep sensitive data like passwords out of the container image and code

B. To speed up container startup time

C. To increase the size of the container image

D. To make the container logs more detailed

Solution

1. Step 1: Understand what Secrets store

   Kubernetes Secrets store sensitive data such as passwords or tokens securely.

2. Step 2: Understand environment variables usage

   Using Secrets as environment variables keeps sensitive data out of code and container images, improving security.

3. Final Answer:

   To keep sensitive data like passwords out of the container image and code -> Option A

4. Quick Check:

   Secrets protect sensitive data = A [OK]

Hint: Secrets keep sensitive data safe outside code [OK]

Common Mistakes:

• Thinking Secrets speed up container startup
• Believing Secrets increase container size
• Assuming Secrets add logging details

2. Which of the following is the correct syntax to use a Kubernetes Secret named mysecret as an environment variable API_KEY in a Pod spec?

easy

A. "env": [{"secretKeyRef": {"name": "mysecret", "key": "api_key"}}]

B. "env": [{"name": "API_KEY", "value": "mysecret"}]

C. "env": [{"name": "API_KEY", "valueFrom": {"secretKeyRef": {"name": "mysecret", "key": "api_key"}}}]

D. "env": [{"name": "API_KEY", "secretRef": {"name": "mysecret"}}]

Solution

1. Step 1: Identify correct env var syntax for Secrets

   The correct syntax uses valueFrom.secretKeyRef with name and key fields.

2. Step 2: Match syntax to options

   "env": [{"name": "API_KEY", "valueFrom": {"secretKeyRef": {"name": "mysecret", "key": "api_key"}}}] matches the correct structure exactly, specifying the secret name and key.

3. Final Answer:

   "env": [{"name": "API_KEY", "valueFrom": {"secretKeyRef": {"name": "mysecret", "key": "api_key"}}}] -> Option C

4. Quick Check:

   Use valueFrom.secretKeyRef with name and key = D [OK]

Hint: Use valueFrom.secretKeyRef with secret name and key [OK]

Common Mistakes:

• Using value instead of valueFrom
• Missing the key field inside secretKeyRef
• Using secretRef instead of secretKeyRef

3. Given this Pod spec snippet, what will be the value of environment variable DB_PASSWORD inside the container?

env:
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: db-secret
      key: password

Assuming the Secret db-secret has the key password with value supersecret123.

medium

A. db-secret

B. DB_PASSWORD

C. password

D. supersecret123

Solution

1. Step 1: Understand valueFrom.secretKeyRef usage

   The environment variable gets its value from the Secret named db-secret and key password.

2. Step 2: Check Secret key value

   The Secret key password holds the value supersecret123, so that is assigned to DB_PASSWORD.

3. Final Answer:

   supersecret123 -> Option D

4. Quick Check:

   Env var gets Secret key's value = B [OK]

Hint: Env var equals Secret's key value, not name or key name [OK]

Common Mistakes:

• Using Secret name as value
• Using key name as value
• Confusing env var name with Secret key

4. You created a Secret named app-secret with key token. You try to use it in a Pod environment variable but get an error: secret "app-secret" not found. What is the most likely cause?

medium

A. The Secret was created in a different namespace than the Pod

B. The Secret key name is misspelled in the Pod spec

C. The Pod spec uses value instead of valueFrom

D. The container image does not support environment variables

Solution

1. Step 1: Understand Secret scope in Kubernetes

   Secrets are namespace-scoped. If the Pod is in a different namespace, it cannot access the Secret.

2. Step 2: Analyze error message

   The error secret "app-secret" not found usually means the Secret does not exist in the Pod's namespace.

3. Final Answer:

   The Secret was created in a different namespace than the Pod -> Option A

4. Quick Check:

   Secret must be in same namespace as Pod = C [OK]

Hint: Check Secret and Pod namespaces match [OK]

Common Mistakes:

• Ignoring namespace differences
• Assuming key name typo causes 'not found' error
• Blaming container image for env var errors

5. You want to mount multiple keys from a Secret named config-secret as environment variables in a Pod. Which is the best way to do this efficiently?

hard

A. Mount the Secret as a volume and read files inside the container

B. List each key separately under env with individual valueFrom.secretKeyRef entries

C. Create multiple Secrets, one per key, and reference each in env

D. Encode all keys into one string and store as a single Secret key

Solution

1. Step 1: Understand environment variable mapping from Secrets

   You can map each Secret key to an environment variable by listing them separately under env with valueFrom.secretKeyRef.

2. Step 2: Compare alternatives

   Mounting as volume is valid but not environment variables. Multiple Secrets or encoding keys complicate management.

3. Final Answer:

   List each key separately under env with individual valueFrom.secretKeyRef entries -> Option B

4. Quick Check:

   Map each key to env var individually = A [OK]

Hint: Map each Secret key individually in env list [OK]

Common Mistakes:

• Mounting Secret as volume when env vars needed
• Creating many Secrets instead of one
• Combining keys into one encoded string